Skip to main content
日本語 简体中文 繁體中文

[Access Control] How to Temporarily Relax Access Control Restrictions

Question

Please explain how to temporarily relax Access Control.

Answer

Please refer to the following for typical methods and Settings for relaxing access control.
Note that if you create a new access policy, you will need to assign the created policy by following the Procedure for assigning access policy groups to Users.

Please also review the [Notes on reverting Access Control conditions].

Typical Methods and Settings

1. Allow access from any location / device as access-free+

By creating an Access policy group without specifying conditions such as IP addresses, you can allow access from anywhere,
enabling Login without being restricted by device or location.
However, please note that leaving access unrestricted increases security risks.

Administrator Tasks

Create a new Access policy group and assign the created policy to the Users you want to grant access-free access.
The access-free policy can be created by setting [Condition to allow access] to [Always allow].

User Tasks

No action is required from the User.

2. Allow access from outside the office for browsers that have an Entrance Pass+

By setting an Entrance Pass Cookie on browsers that have previously connected under Issue entrance pass on login conditions, such as an internal IP,
browsers holding this Entrance Pass can be granted access from outside the office.
Please note that if you Clear the browser's Cookies, the Entrance Pass will also be deleted.

Administrator Tasks

Settings changes are required for [Access policy group] and [Issue entrance pass on login].
For detailed Settings instructions, please refer to Allow Login from outside the office only from company PCs.
Additionally, if Users are unable to connect to the internal IP, you can configure the Entrance Pass Cookie on Users' browsers by creating an "Entrance Pass Issuance User."
For detailed Settings instructions, please refer to Setting an Entrance Pass on a PC that cannot connect to the internal network.

User Tasks

Users must connect under Issue entrance pass on login conditions, such as connecting from an internal IP for the first time or logging in as an "Entrance Pass Issuance User."
For information on how to Confirm that the Entrance Pass Cookie has been successfully issued to the User's browser, please refer to here.

3. Allow access from outside the office by entering an OTP+

By configuring an access policy that requires an OTP when accessing from outside the specified allowed conditions,
Users can be permitted to Login from outside the office by entering an OTP.
Please note that entering an OTP allows access from any environment,
including Personal PCs and rental PCs.
Reference : What is OTP (One-Time Password)?

Administrator Tasks

You need to change the settings for [Access policy group].
For configuration instructions, please refer to Require OTP when accessing from outside the office on a non-company PC.
For information on how to issue OTPs to users, please refer to OTP issuance method and Valid until.
If you receive OTPs via Email Address, the following settings regarding OTP notification destination addresses can be configured by the Is admin in the Access Control Administration.

1. Setting the OTP notification Email Address (per User)
[User] - [Users] - Select the target user - Set the Email Address from [OTP type].

2. Setting to allow users to change their own OTP notification Email Address (per Access policy group)
[Access Control] - [Access policy group] - Select the target policy - "Condition to allow users to change OTP notification Email Address"
[Never allow] : Users cannot change their own OTP notification Email Address.
[Always allow] : Users can change their own OTP notification Email Address.

User Tasks

If you issue OTPs via an app or email, OTP Settings in the User Portal are required.
For detailed Procedure, please refer to [Access Control] User Guide.

4. Allow access via Secure Browser from outside the office+

You can install Secure Browser on a company PC or Personal PC and allow access via Secure Browser from outside the office.
If you are already using Secure Browser on a mobile device, this can be accommodated without changing the access policy.

If you are using Secure Browser for the first time, various Settings in the Administration are required.
It is also possible to distribute devices pre-configured with Secure Browser to users.
For information on how to configure Secure Browser by an administrator, please refer to [Secure Browser] Register Device Information by Administrator.

User Tasks

Please install the app from the PC version Secure Browser download site.
For detailed configuration instructions, please refer to the "Installation Manual (Windows)" and "Installation Manual (MacOS)".

5. Allow access from devices with Device Certificates installed+

You can allow access from devices with Device Certificates installed, regardless of whether the access originates from inside or outside the office.
For additional purchases of Device Certificates when supplies are insufficient, please contact your HENNGE One account representative (cs-order@hennge.com).
Reference : [Device Certificate] Service Introduction

Administrator Tasks

For instructions on registering Device Certificates, please refer to the [Device Certificate] Administrator Help.
Additionally, to allow access from devices that have a Device Certificate installed, you will need to update the Settings of your Access policy group.
For detailed configuration instructions, please refer to the "Access policy group" section in the Access Control Administrator Help.

User Tasks

For instructions on installing Device Certificates, please refer to Device Certificate Installation.

Important Notes When Reverting Access Control Settings

To revert to the previous configuration, please undo any Settings changes that were made to relax Access Control.
Please note that even after reverting the Settings, the authentication status from when Access Control was relaxed may be retained.
Therefore, we recommend disconnecting the authentication session using the procedure described below.

For Microsoft 365 Users

Please Clear the authentication cache.
Reference : [Access Control] Disconnecting Microsoft Entra ID Modern Authentication

For Google Workspace Users

Please disconnect the authentication session by changing your Password.
Reference : Disconnecting Google Workspace Authentication

Translation Disclaimer

This article has been automatically translated from the original Japanese version for your convenience.
While we strive to ensure accuracy, we cannot guarantee its reliability or completeness.

In the event of any discrepancies or questions regarding the content, the official Japanese version shall prevail.